CVE-2013-4278: The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enfo...

Security readout for executives and security teams

This OpenStack Nova issue lets a logged-in cloud user bypass private flavor restrictions and start instances using flavors they should not access. The business impact is unauthorized use of larger or restricted compute profiles, which can undermine quota planning, tenant controls, and cost governance. Exposure is likely limited to OpenStack Nova Folsom, Grizzly, or Havana deployments that used private flavors for access control or resource segmentation. Public cloud or private cloud tenants with valid credentials are the relevant threat population. Prioritize remediation if the organization still operates legacy OpenStack Nova releases or relies on private flavors to separate customer tiers, privileged workloads, or high-cost compute resources. Modernized or retired deployments lower urgency. Mitigation focus: Check OpenStack and distribution advisories for fixed Nova packages for affected releases.; Apply relevant vendor updates, including distribution security updates where applicable.; Review use of private flavors and tenant flavor access controls..

Prepared

Jun 14, 2026, 15:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.